Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.api.newg####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) nb-####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) oss.newg####.com.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) 2####.107.1.1:80
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- c####.api.newg####.com
- c####.g####.ig####.com
- c####.m.newg####.com
- c-h####.g####.com
- hm.b####.com
- img.nb####.newg####.com
- ip.ta####.com
- log.u####.com
- oss.newg####.com
- pub-####.qin####.com
- s####.u####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- c####.api.newg####.com/m/m/node_modules/jquery/dist/jquery.js?h=####
- c####.api.newg####.com/m/m/page/post-detail/images/button-like.png?h=####
- c####.api.newg####.com/m/m/pkg/page/post-detail/post-detail.html_aio.css...
- c####.api.newg####.com/m/m/pkg/page/post-detail/post-detail.html_aio.js?...
- c####.api.newg####.com/m/m/static/images/icon_loading.png?h=####
- c####.api.newg####.com/m/m/static/images/icon_view.png?h=####
- c####.api.newg####.com/m/m/static/lib/mod.js?h=####
- c####.api.newg####.com/m/m/widget/to-top/icon3.png?h=####
- c####.api.newg####.com/m/post/60000000060974/comments?only_author=####&o...
- c####.api.newg####.com/m/posts/60000000060974?Device-Id=####&f=####
- c####.api.newg####.com/v2/api/forums/50000000012397
- c####.api.newg####.com/v2/api/forums/50000000012397/users?limit=####&off...
- c####.api.newg####.com/v2/api/game_assistant/ads?category=####
- c####.api.newg####.com/v2/api/games/10000000006023
- c####.api.newg####.com/v2/api/images/25de65b4e628a744bbfe29ce90c283c2.jp...
- c####.api.newg####.com/v2/api/images/312620e5237c89fab50c04fca7ac063f.jp...
- c####.api.newg####.com/v2/api/images/33d70c84d24ca0db78b37414ae737710.pn...
- c####.api.newg####.com/v2/api/images/386a8b8e4aa6bb6af716ce05bf4e59c9.pn...
- c####.api.newg####.com/v2/api/images/44ce0196b8de012a3d878343407ca1dc.jpeg
- c####.api.newg####.com/v2/api/images/46ceba7cd30be7084fcb124156b99868.pn...
- c####.api.newg####.com/v2/api/images/491dee7d2c9f2abda7193ff9a08153b1.pn...
- c####.api.newg####.com/v2/api/images/50e503ace73c66322d2a1b8db4ab2810.pn...
- c####.api.newg####.com/v2/api/images/51b2035e73ca7773958f2205122eccc0.jpeg
- c####.api.newg####.com/v2/api/images/58ce21fb72909076f199f354e90cc8e1.jp...
- c####.api.newg####.com/v2/api/images/5c64c7f59b5d70d82a92b2071f21fbb1.jpg
- c####.api.newg####.com/v2/api/images/6384309622c3b62ab5a31c30bcfa9021.jp...
- c####.api.newg####.com/v2/api/images/669391de76fee3a93171878030b23102.jp...
- c####.api.newg####.com/v2/api/images/673d8cccbf4168ae3b0b581b11c96c52.jpeg
- c####.api.newg####.com/v2/api/images/7c464c1894260d63f8842ff4d6c8c2e2.jpeg
- c####.api.newg####.com/v2/api/images/7dbf09e165809d9f2fc989b95f56d9d7.jp...
- c####.api.newg####.com/v2/api/images/7fc382fb550ae4773839e815b32be177.pn...
- c####.api.newg####.com/v2/api/images/827e497be30432a6f221bb21acf46199.jp...
- c####.api.newg####.com/v2/api/images/84a20595931bf3d86d7cf06766945517.jp...
- c####.api.newg####.com/v2/api/images/84c619ef387590b8a70ef9e5ded7a08f.pn...
- c####.api.newg####.com/v2/api/images/850a6892f8a5dbe4c1fa739245097095.jpeg
- c####.api.newg####.com/v2/api/images/94f0222b9daf450f6593e16fd429eb68.pn...
- c####.api.newg####.com/v2/api/images/a79d94fc0f9377d8f4bbfed1ee8cc246.jp...
- c####.api.newg####.com/v2/api/images/acad14835767c1e203d259d31312856a.jp...
- c####.api.newg####.com/v2/api/images/acad14835767c1e203d259d31312856a.jpeg
- c####.api.newg####.com/v2/api/images/bd7ab7c704bf6a887994cc1ed0b5887d.jp...
- c####.api.newg####.com/v2/api/images/c27d178691a0f18ce47ee38e874b201e.pn...
- c####.api.newg####.com/v2/api/images/ccf6bde588628b4f210a0324261f41e9.jpeg
- c####.api.newg####.com/v2/api/images/e612681278e284b0e1296efd988091ba.jpeg
- c####.api.newg####.com/v2/api/images/ec3919904ea48c2690ea86d1ec91c33a.jpeg
- c####.api.newg####.com/v2/api/images/fb472136acbe62dae5c2db1a2ba45d1d.jp...
- c####.api.newg####.com/v2/api/images/fbeff1df7814ff11d54a9a882ae731ac.jp...
- c####.api.newg####.com/v2/api/images/ff0c6e9dd2316b0b912419e1821eef90.pn...
- c####.api.newg####.com/v2/api/newgames/10000000006023/gift_list?offset=#...
- c####.api.newg####.com/v2/api/newgames_with_posts?offset=####&limit=####
- c####.api.newg####.com/v2/api/posts/50000000012397/sticky
- c####.api.newg####.com/v2/api/posts/50000000012397?limit=####&offset=###...
- c####.api.newg####.com/v2/api/posts/60000000060974/detail
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?7507191####
- ip.ta####.com/service/getIpInfo2.php?ip=####
- nb-####.oss-cn-####.aliy####.com/25de65b4e628a744bbfe29ce90c283c2.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/312620e5237c89fab50c04fca7ac063f.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/33d70c84d24ca0db78b37414ae737710.png@!w...
- nb-####.oss-cn-####.aliy####.com/386a8b8e4aa6bb6af716ce05bf4e59c9.png@!w...
- nb-####.oss-cn-####.aliy####.com/44ce0196b8de012a3d878343407ca1dc.jpeg
- nb-####.oss-cn-####.aliy####.com/46ceba7cd30be7084fcb124156b99868.png@!w...
- nb-####.oss-cn-####.aliy####.com/491dee7d2c9f2abda7193ff9a08153b1.png@!w...
- nb-####.oss-cn-####.aliy####.com/50e503ace73c66322d2a1b8db4ab2810.png@!w...
- nb-####.oss-cn-####.aliy####.com/51b2035e73ca7773958f2205122eccc0.jpeg
- nb-####.oss-cn-####.aliy####.com/58ce21fb72909076f199f354e90cc8e1.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/5c64c7f59b5d70d82a92b2071f21fbb1.jpg
- nb-####.oss-cn-####.aliy####.com/6384309622c3b62ab5a31c30bcfa9021.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/669391de76fee3a93171878030b23102.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/673d8cccbf4168ae3b0b581b11c96c52.jpeg
- nb-####.oss-cn-####.aliy####.com/7c464c1894260d63f8842ff4d6c8c2e2.jpeg
- nb-####.oss-cn-####.aliy####.com/7dbf09e165809d9f2fc989b95f56d9d7.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/7fc382fb550ae4773839e815b32be177.png@!w...
- nb-####.oss-cn-####.aliy####.com/827e497be30432a6f221bb21acf46199.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/84a20595931bf3d86d7cf06766945517.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/84c619ef387590b8a70ef9e5ded7a08f.png@!w...
- nb-####.oss-cn-####.aliy####.com/850a6892f8a5dbe4c1fa739245097095.jpeg
- nb-####.oss-cn-####.aliy####.com/94f0222b9daf450f6593e16fd429eb68.png@!w...
- nb-####.oss-cn-####.aliy####.com/a79d94fc0f9377d8f4bbfed1ee8cc246.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/acad14835767c1e203d259d31312856a.jpeg
- nb-####.oss-cn-####.aliy####.com/acad14835767c1e203d259d31312856a.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/bd7ab7c704bf6a887994cc1ed0b5887d.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/c27d178691a0f18ce47ee38e874b201e.png@!w...
- nb-####.oss-cn-####.aliy####.com/ccf6bde588628b4f210a0324261f41e9.jpeg
- nb-####.oss-cn-####.aliy####.com/e612681278e284b0e1296efd988091ba.jpeg
- nb-####.oss-cn-####.aliy####.com/ec3919904ea48c2690ea86d1ec91c33a.jpeg
- nb-####.oss-cn-####.aliy####.com/fb472136acbe62dae5c2db1a2ba45d1d.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/fbeff1df7814ff11d54a9a882ae731ac.jpeg@!...
- nb-####.oss-cn-####.aliy####.com/ff0c6e9dd2316b0b912419e1821eef90.png@!w...
- oss.newg####.com.####.com/ng-pkgs/2406.22011304/????9.26####
- qin####.com.www.####.com/tdata_EDT369
- t####.c####.q####.####.com/config/hz-hzv6.conf
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_IcB528
- t####.c####.q####.####.com/tdata_Uad612
Запросы HTTP POST:
- a####.u####.com/app_logs
- c####.api.newg####.com/v2/api/game_assistant/boot_config_v2
- c####.api.newg####.com/v2/api/game_assistant/offprint
- c####.api.newg####.com/v2/api/pkgs
- c####.api.newg####.com/v2/api/pnames/filtout/first
- c####.api.newg####.com/v2/api/report
- c####.api.newg####.com/v2/api/report/download/games/click
- c-h####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0.xml
- /data/data/####/7811f714bccd
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/GameCrack_Preferences.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/deviceId.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/forum_page.0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/http_clan.m.newgamer.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
- /data/data/####/newgame.db-journal
- /data/data/####/ngdsdownload.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/reservation_new_games_list.0
- /data/data/####/reservation_new_games_list.0.tmp
- /data/data/####/run.pid
- /data/data/####/statistics_Preferences.xml
- /data/data/####/sys_prefs.xml
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_IcB528
- /data/data/####/tdata_IcB528.jar
- /data/data/####/tdata_Uad612
- /data/data/####/tdata_Uad612.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-1500890166.tmp
- /data/media/####/-1517786826.tmp
- /data/media/####/-1667119235.tmp
- /data/media/####/-1741733945.tmp
- /data/media/####/-182767312.tmp
- /data/media/####/-1835765376.tmp
- /data/media/####/-1845310219.tmp
- /data/media/####/-2141178313.tmp
- /data/media/####/-2141411675.tmp
- /data/media/####/-250627269.tmp
- /data/media/####/-434881305.tmp
- /data/media/####/-523350454.tmp
- /data/media/####/-786270356.tmp
- /data/media/####/-91676706.tmp
- /data/media/####/-950039815.tmp
- /data/media/####/108132755.tmp
- /data/media/####/1277629132.tmp
- /data/media/####/1278928114.tmp
- /data/media/####/1514923895.tmp
- /data/media/####/1559097532709
- /data/media/####/1915400357.tmp
- /data/media/####/1963932087.tmp
- /data/media/####/2047354339.tmp
- /data/media/####/2048458810.tmp
- /data/media/####/2112119838.tmp
- /data/media/####/2133586188.tmp
- /data/media/####/232492350.tmp
- /data/media/####/534356736.tmp
- /data/media/####/590470653.tmp
- /data/media/####/788308023.tmp
- /data/media/####/894421114.tmp
- /data/media/####/969212921.tmp
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.newgame.gamehelper.wzry.bin
- /data/media/####/com.newgame.gamehelper.wzry.db
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_IcB528
- /data/media/####/tdata_Uad612
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- <Package Folder>/files/gdaemon_20161017 0 <Package>/cn.com.ngds.newgame.service.PushService 25723 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- mount
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/cn.com.ngds.newgame.service.PushService 25723 300 0
Загружает динамические библиотеки:
- getuiext2
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
Управляет Wi-Fi-подключением.
